Unknown column 'x' in 'where clause' [1054]

Question

My website is integrated with phpbb forums, and I'm trying to have one php file and one template to pull up a unique page using different rows in the database. My example files look like this:

php file:

<?php
include "includes/phpbb.php";

$template->set_filenames(array(
'body'  => 'people.html',
));

$name = $_GET['name'];
$result = $db->sql_query("SELECT * FROM people WHERE name = $name");
while($row = $db->sql_fetchrow($result))
{
$template->assign_vars(array(
'NAME'          => $row['name'],
'AGE'           => $row['age'],
    ));
}

$site->page_footer();

?>

Here is the html template:

<!-- INCLUDE overall_header.html -->

{NAME} is {AGE} years old.

<!-- INCLUDE overall_footer.html -->

I have two rows in the table. One is named "Walt" with the age of "51", and the other is "Jesse", with the age of "25". Whenever I enter a url like people.php?name=Walt, I get an error page:

SQL ERROR [ mysqli ]

Unknown column 'Walt' in 'where clause' [1054]

SQL

SELECT * FROM people WHERE name = Walt

If I enter a numerical value of ANY kind, it pulls up the page fine, but no variables filled in, so the page says "is years old". If I enter ?name=name, it pulls up the second row in the database table, and says "Jesse is 25 years old" (That one REALLY puzzles me right there).

What am I doing wrong to cause this? I obviously want to be able to enter "Walt" or "Jesse" in the url, and get the entire page with just their row of information.

Answer 1

Simply you need to enclose your variable in a string. So:

$result = $db->sql_query("SELECT * FROM people WHERE name = '$name'");

should do the trick.

Be very very very careful. I think the $db object is coming from phpbb, and they would sanitize any database query before executing it. But blindly taking user input and querying against the database without sanitation will lead to SQL Injection and world of pain. See What's the best method for sanitizing user input with PHP?

Answer 2

name should be in quotes:

$result = $db->sql_query("SELECT * FROM people WHERE name = '$name'");